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Abstract: Most continuous-variable quantum key distribution schemes are 
based on the Gaussian modulation of coherent states followed by continuous 
quadrature detection using homodyne detectors. In all previous schemes, 
the Gaussian modulation has been carried out in conjugate quadratures thus 
requiring two independent modulators for their implementations. Here, we 
propose and experimentally test a largely simplified scheme in which the 
Gaussian modulation is performed in a single quadrature. The scheme is 
shown to be asymptotically secure against collective attacks, and considers 
asymmetric preparation and excess noise. A single-quadrature modulation 
approach renders the need for a costly amplitude modulator unnecessary, 
and thus facilitates commercialization of continuous-variable quantum key 
distribution. 
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1. Introduction 


The quantum informational primitive of quantum key distribution (QKD) allows two parties 
(Alice and Bob) to distill a secret key using an untrusted quantum channel and an authenticated 
classical channel |[T]. Various forms of QKD have been proposed and experimentally realized 
in laboratories and under real-life field conditions @0. and they can be roughly divided into 
two different categories which depend on the actual measurement strategy at Bob’s station: 
Measurement of a discrete variable (DV) - the photon number - carried out by photon counters 
or measurement of a continuous variable (CV) Q - the field quadratures - performed by a 
homodyne detector. They are referred to as DVQKD and CVQKD, respectively. 

While DVQKD is the most matured scheme in terms of security proofs ||6||7), secure commu¬ 
nication distance Q and real-life field tests ||9p0[, the scheme of CVQKD is rapidly becoming 
a serious competitor due to recent promising developments. This includes the recent advances in 
deriving composable security proofs 111 ■ T^, the development of very efficient post-processing 
algorithms for the distillation of a secret shared key from the raw key OlHTg, the implementa¬ 
tions of long-distance QKD HI) and the recent developments of more advanced protocols such 
as measurement-device-independent CVQKD fTS) and squeezed states QKD | [T6l[T9) . More¬ 
over, most protocols of CVQKD benefit from the fact that the associated technology required 
for real-world integration is based on standard telecommunication components. 

Coherent state based CVQKD protocols can be distinguished by the different input alphabets. 


Previous proposals have included discrete 120 ■ 221 as well as continuous 123 241 modulation 
patterns of Gaussian states in phase space. Most of these schemes are based on the modulation 
of states in conjugate bases, similarly to the famous BB84 protocol | |25| where a polarization 
eigenstate is modulated in conjugate bases. In BB84, the swapping between conjugate bases 
is an absolute necessity for establishing security, but this is not the case for the modulation of 
Gaussian states. In this case, the modulated states are not eigenstates of the modulation basis 
(in contrast to BB84) but non-orthogonal, and thus the basic non-orthogonality requirement for 
secure communication is fulfilled even in a single basis | [2^[27| . Single-quadrature modulation 
has been considered for a two-state protocol with coherent states p7p8) and for the continuous 
modulation of squeezed states | [29| followed by homodyne detection. 

In this Letter we develop a protocol using modulated coherent states in a single quadrature. 
Our security analysis includes excess and preparation noise, and we present a proof-of-principle 
experimental implementation of the protocol using both homodyne and heterodyne detection. 
Single-quadrature CVQKD is highly relevant as it allows for a simplification of the required 
technology at the sending station and, thus, leads to an important reduction in the cost. For 
a dual-quadrature Gaussian modulation scheme, an amplitude as well as a phase modulator 
is needed while the single-quadrature scheme can be implemented with a single modulator, 
e.g. leaving out the amplitude modulator. This constitutes a significant reduction in complexity 
and cost as an amplitude modulator is based on an interferometric configuration (that must be 
stabilized) and is very expensive in terms of optical power consumption. 

In preparation of this manuscript we discovered that the idea of a single quadrature CVQKD 
protocol has been independently developed by Usenko et al. 0, where the implications of 
an asymmetric channel are considered. We finalized our security analysis with inspiration from 
this work. 














2. Theory 

We consider the Prepare-and-Measure CVQKD protocol illustrated in Fig.[T] Random numbers 
drawn from a one-dimensional Gaussian alphabet are used to modulate the phase quadrature, 
P, at Alice’s station, thereby preparing independent coherent states along a line in phase space. 
This is in stark contrast to previous protocols where a two-dimensional Gaussian distribution 
is used to drive phase and amplitude quadratures. The prepared states are sent to Bob who 
performs a coherent detection of the quadratures, either using a heterodyne detector or a homo¬ 
dyne detector that switches between an amplitude and a phase quadrature measurement. The 
list of data obtained by Bob (when he measured the P quadrature) is correlated with the list 
of Alice, and this correlation is subsequently used to generate a secret key by means of error 
reconciliation and privacy amplification. 

The security of the scheme can be addressed by using the theoretical equivalence between 
the prepare-and-measure scheme and an entanglement-based scheme |32|^|, see Fig. In 
the entanglement-based scheme, Alice prepares an Einstein-Podolsky-Rosen (EPR) state of 
variance keeps one mode of the EPR state to herself and sends the other mode to Bob. 
If Alice performs a heterodyne measurement on her mode (that is projecting it onto a coherent 
state), the remaining mode will form a 2D Gaussian distribution of coherent states while a 
homodyne measurement at Alice will form a ID Gaussian distribution of squeezed states. A ID 
distribution of coherent states can thus be realized by performing a local squeezing operation 
with a squeezing parameter of i* = log(^//I') onto the second mode before it is sent to Bob. 
Assuming that the covariance matrix of the EPR state has the symmetric form 
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Figure 1. Prepare-and-measure protocol based on modulating a single quadrature (phase) 
and equivalent entanglement-based model used to calculate the secret key rate. EPR: 
Einstein-Podolsky-Rose source, Sqz: Squeezing operation. 




























then the local squeezing transforms it to the matrix 
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To assess the security of the proposed scheme against collective attacks, we consider a gen¬ 
eralized Gaussian attack, the asymmetric entangling doner attack, which is the most powerful 
attack that can be performed on the quantum channel, in the limit of infinite exchanges, where 
Gaussian extremality holds true 1 5|23 1. Such an attack can be executed by a local unitary equiv¬ 
alent to an asymmetric beam splitter with one mode of an EPR state controlled by Eve in the 
secondary input port. She also has control over the beam splitting ratio and the degree of asym- 
metricity, and is limited only by the laws of quantum mechanics. Eve keeps the other mode of 
her EPR state in a quantum memory and interferes the first mode with the coherent states sent 
by Alice. The interfered mode is saved in another quantum memory. Eve’s information gain in 
the limit of infinitely many uses of the channel is upper bounded by the Holevo quantity Q. 

In this asymptotic limit, the asymptotic equipartition property applies and both the Shannon 
and the von Neumann entropy are well defined quantities | |34p5| . Einite key sizes have a subtle 
impact on the security proofs 113 ^ which will not be considered in this paper. As a first 
approximation, neglecting these issues, one arrives at the following bound on the secret key 
rate |[T]|3, 

R = l5l{A:B)-x{E:X) , (4) 


where j3 is the reconciliation efficiency and I{A : B) is the classical mutual information between 
Alice and Bob expressed through the Shannon entropy of the corresponding classical stochastic 
variables of the measurements p^ . xiE -X) is the Holevo quantity p4) between Alice (Bob) 
and Eve for direct (reverse) reconciliation, which can be expressed by the von Neumann entropy 
S{p) — 5(r) of the quantum state p, x{E -X) = S{E) — S{E\X) ||^. Eor Gaussian states with 
zero mean, p can be completely described by its covariance matrix E. 

The von Neumann entropy for a Gaussian state p is given by Q 


5(r) = i:g(v,), 
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where 


8{x) 
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and Vi is the /’th value in the symplectic spectrum of F, and the function g{x) is normalized in 
units of vacuum noise. The symplectic spectrum is calculated by finding the absolute eigenval¬ 
ues of the matrix iOT, where 
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with N being the number of modes described by the state p. 

We include trusted preparation noise in our model to account for its presence in the experi¬ 
mental implementation pTHTO] . Theoretically, this is simulated by assuming that the environ¬ 
ment prepares an EPR state, one mode of which is interfered with the signal mode on a beam 





















splitter with splitting ratio 7 ] « 1 before it enters the quantum channel. In the limit of no prepara¬ 
tion noise, this beam splitter will of course substitute part of the EPR state with vacuum noise, 
but an appropriate redefinition of the system parameters makes this error insignificant. More 
importantly, this approximation does not overestimate the security of the protocol, since the 
dilution only reduces the correlations between Alice and Bob. We get the following covariance 
matrix. 
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where fj = — rj. fi' and k' are the parameters before the redefinition, and the squeezing 

parameter r is used to determine the asymmetry of the preparation noise. The dummy parame¬ 
ters are related to the actual protocol parameters by the following equations 
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which have the following solutions 
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where the determinant A is given by 


(16) 

(17) 


A= ^(12v^v/277i3-547i2-4772+277i+108y^-108V^)772 . (18) 

After this redefinition we assume the preparation noise to be added to our signal beam to 
have the variance Kp in the phase quadrature and Kq in the amplitude quadrature, while the 
signal variance in the phase quadrature is jj. — 1. The environmental modes are not accessible 
to the eavesdropper and so the noise is trusted. Letting the environment prepare an EPR state in 
this manner conveniently leaves the global state pure. 

We propagate through the quantum channel with asymmetric loss parameters Tq and 
Tp for the amplitude and phase quadratures, respectively, also interfering with Eve’s noisy EPR 
state with variances Wq and Wp, respectively. 

The covariance matrix of the global state following the quantum channel is quite large, so 
only the most important submatrix will be presented here. This is the matrix that represents the 
two-mode state shared by Alice and Bob. 
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with Vj = /r' — 1. Eirstly, the classical mutual information between Alice and Bob is, after 
some algebra, found to be 
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In the limit of Jfp = 0 and t] = 1 this is similar to the expression one would expect from 
a dual quadrature protocol with half the alphabet. Eor heterodyne detection the expression is 
quite similar. 
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with the addition of a unit of vacuum. The relevant transmission in both cases is the one in 
the P-quadrature, since this is the encoded quadrature. Similarly, only the excess noise in the 
P quadrature degrades the mutual information. However, the excess noise in the conjugate 
quadrature has a profound impact on the security, which will be elaborated on later. 



The expression for the Holevo bound is significantly more complicated. We begin by con¬ 
sidering the quantity S{E), which denotes the von Neumann entropy of Eve’s EPR state. If 
we assume that the eavesdropper is able to purify the global state, it is easy to show that 
S{E) = S{ABk), where S{ABk) is the von Neumann entropy of the total multimode system of 
Alice, Bob and the EPR state which injects the preparation noise. Purification is a useful tech¬ 
nique in this case because it allows one to estimate the information gain of the eavesdropper 
without having access to her measurements. Because of the added complication of preparation 
noise, there is no (short) closed expression for the von Neumann entropy of this state. The sym- 
plectic spectrum of which represents this global state is easily calculated numerically, for 
a given choice of channel and input parameters. Similarly, purification allows the conditional 
von Neumann entropies to be written as S{E\B) — S{Ak\B). Again, since the symplectic eigen¬ 
values, which are used to calculate the von Neumann entropies, do not permit short analytical 
expressions, they are calculated numerically and inserted into Eqs. 0,© and 0 to calculate 
the secret key rate. 

Since preparation noise has been incorporated into the security analysis, it makes sense to 
also investigate the case of direct, rather than reverse, reconciliation since it is known from 
dual quadrature protocols that it offers an advantage in cases of extremely large preparation 
noise pTp9pO) . This is done by considering the conditional entropy 5(£’|A) = 5 (Bk'|A) rather 
than S{E\B) = S{Ak\B), but otherwise offers no additional computational complications. 

A security proof for a dual quadrature protocol usually assumes symmetry between the 
quadratures, but for the presented protocol this is naturally not the case. The fact that only 
one quadrature is encoded has an important implication, in the sense that the squeezed EPR 
correlations in Eq. ( [T9] l in the amplitude quadrature are not accessible to Alice and Bob. In 
other words, they have no way of estimating Tq. Tp is estimated as normal, and the variance of 
the amplitude quadrature has to be monitored to detect the level of excess noise in this quadra¬ 
ture. However, monitoring the variance alone is not enough to determine Tq. Eortunately, it 
is possible to place a bound on the possible values of Tq, through Heisenberg’s inequality. In 
the covariance matrix description the inequality has the form Tabk + > 0, i.e. the matrix 

Tabk + must be positive semi-definite. The physicality is tested by a simple numerical deter¬ 
mination of the eigenvalues of this matrix, as they must be non-negative for Tabk to be physical. 
With this bound one can map out a region of security in (Tp, Tq) space. This is done in Eig.|^ 
where excess noise is added, and from Eig. 0a) to Eig. 0b) there is a clear increase in the 
size of the region of physicality. If neither excess nor preparation noise is present, the bound 
enforces the relation Tp = Tq. However, even minute amounts of noise will widen the bound 
and since Tq is controllable by the eavesdropper a worst case scenario approach is taken and 
Tq is thus always chosen to give the lowest possible rate. 

In Eig.0we plot the secret key rate as a function of channel attenuation for different detection 
strategies both for the 2D and the ID Gaussian modulation patterns, using reverse reconcilia¬ 
tion. In Fig. 0a) there is no excess noise, while in Fig. 0b) Wq = Wp = 1.05 SNU. In both 
cases we assume no preparation noise. The modulation variance was optimized for each chan¬ 
nel attentuation value to obtain the largest possible secret key rate. The insets of Fig. 0 shows 
the secret key rates for an ideal error reconciliation efficiency of j3 = 100%, while a realistic 
value of j3 = 97 % was assumed for the main figure. 

In Fig. 0 the secure key rate is plotted for different levels of preparation noise, with reverse 
reconciliation in Fig. 0a) and direct reconciliation in Fig. 0b). 

As was reported by Weedbrook et al., in | |40| and Jacobsen et al, in pT) , the single quadra¬ 
ture protocol retains its robustness to preparation noise when using direct reconciliation. This is 
shown in Fig. 0 From this it is also evident that an optimal non-zero level of preparation noise 
exists. 
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Figure 2. Theory plots of the region of positive secret key rates using single-quadrature 
modulation with a heterodyne detection strategy in terms of the asymmetric channel loss. 
The dashed black line is the symmetric value Tp = Tq, and the black solid line is the choice 
of Tq that minimizes the rate. Plot (a) has excess noise of Wp = Wq = 1.005 SNU , while 
for (b) Wp = Wq = 1.05 SNU. /t = 31 SNU, jS = 1 and (Cq = ff/. = 0. 
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Figure 3. Theory plots of secret key rates for protocols using single- and dual-quadrature 
modulation respectively, with homodyne and heterodyne detection strategies. Both plots 
use reverse reconciliation, and plot (a) has no excess noise, while for (b) Wq = Wp = 1.05 
SNU. The modulation variance was optimized for each protocol and channel attenuation 
in the P quadrature to obtain the largest possible secret key rate. P =91% except for both 
insets where j6 = 100% was assumed. 


From the plots in Figs. andit is clear that a single modulated quadrature combined 
with the right channel offers quantum security, albeit slightly reduced from a protocol using 
both quadratures. In general one has to trade lower key rates and a reduction in tolerated channel 
loss for experimental simplicity. In the single quadrature scheme, half of the measurements 
(2-quadrature measurements) are not used for key generation but only for state estimation. 
This naturally reduces the rate by a factor of two. It can, however, be partially compensated 
by introducing an asymmetry in the heterodyne detector or the switching probability of the 
homodyne detector. 






































(b) Direct reconciliation 
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Figure 4. Theory plots of secret key rates with varying degrees of preparation noise in the 
encoded quadrature. Plot (a) uses reverse reconciliation, while for (b) direct reconciliation 
is used. j3 = 1, ^ = 1000 and Wq = Wp = 1. 


3. Experiments 



Figure 5. Schematic of the experimental setup. At Alice’s station a laser beam was split 
into a reference and a signal beam. The signal beam was phase modulated with Gaussian 
white noise. After transmission of both beams to Bob, he performed heterodyne detection 
by interfering the two equally bright beams at a balanced beam splitter while the phase 
was locked to njl. Flomodyne detection was done by brightening the local oscillator while 
dimming the signal beam to satisfy the brightness approximation. The two outputs of the 
two photo detectors as well as the noise from the Gaussian white noise generator were 
recorded. 

We demonstrate the single-quadrature CVQKD schemes with heterodyne and homodyne de¬ 
tection using bulk optical components. A schematic of the experimental setup is shown in Fig.|^ 
The optical power and the electronics can be adjusted to make the detection stage function as 
either a heterodyne or homodyne detector. 

For heterodyning a 1064nm continuous-wave laser beam was split equally into a reference 
(local oscillator) and a signal beam, each carrying a power of 2.8 mW. For homodyning, the 
signal power was adjusted to 0.1 mW, while the reference beam (local oscillator) was kept at 




























































2.8 mW. The signal beam was modulated in phase with an electro-optical phase modulator us¬ 
ing Gaussian white noise from a white noise generator. The reference as well as the signal 
beam were then transmitted to Bob who performed heterodyne detection which was imple¬ 
mented by interfering both beams at a balanced beam splitter and locking the relative phase 
to njl. For homodyne detection were interfered at the same beam splitter, but the P and Q 
quadratures were measured by switching the quadrature between runs, by locking the relative 
phase between the signal and reference beams io njl and 0 respectively. The AC outputs of the 
photo detectors were demodulated at 10.5 MHz and low-pass filtered at 100 kHz before being 
sampled with a Mbit data acquisition card with a sampling rate of 500 kHz. For heterodyning, 
in post-processing the sum and difference of the two sampled data streams were calculated. 
These outputs represent measurements of the amplitude and phase quadrature amplitude, re¬ 
spectively, when both beams have the same optical power. In the homodyne measurement, Q 
and P quadrature data is found in post-processing by the difference of the two sampled data 
streams. In addition to these measured data (at Bob), we also recorded the data resulting from 
the white noise generator (at Alice). 

The vacuum reference was measured by disconnecting the white noise generator from the 
phase modulator. After that the phase modulation was first set to a modulation variance of 
15 dB above vacuum which set the 100% transmission value. For heterodyning, the modulation 
variance was subsequently reduced to simulate optical loss in the channel. Since only coherent 
states were involved in our implementation this procedure is equivalent to introducing optical 
loss. However, this scheme enabled us to perform heterodyne detection in the form described 
above, since the requirement of having the same optical power in reference and signal beam 
was fulfilled. For homodyne detection, loss was introduced via beamsplitters and waveplates, 
as there is no power requirement in the signal beam in this configuration. 

For each measurement run we recorded 10^ samples and estimated the excess noise and 
transmission of the channel. The magnitude of the correlations directly defines the level of the 
mutual information, through the formula 



( 22 ) 


where Vg is the variance of Bob’s measurement in the signal quadrature, Va is the variance of 
Alice’s input signal, and Cab is the covariance between the data sets. The preparation noise 
was determined at 100% transmission where no excess noise introduced by the eavesdropper 
is present. This noise level is calculated by subtracting the (properly scaled) input with the out¬ 
put. In the limit of perfect correlations, one would expect such a subtraction to yield zero. Any 
residual variance is therefore to be regarded as noise. If the correlations are poor, the prepara¬ 
tion noise consequently goes up. For transmissions lower than unity, the combined excess and 
preparation noise is again determined by subtraction. The scaling of the preparation noise with 
transmission is known, so any leftover noise in the combined noise must be ascribed to the 
eavesdropper, i.e. excess noise. 

3.1. Heterodyne results 

The results for heterodyne detection are shown in Fig. For heterodyne detection the prepa¬ 
ration noise was determined to Kq = 0.07 SNU and Kp = 0.025, which is related to imper¬ 
fect modulation performed by Alice due to a mismatch between the electro-optical modulation 
and the recorded data stream of the from an analogue white noise generator. The asymmetric 
excess noise levels Wq = 1.004 SNU and Wp = 1.005 SNU, respectively, were on the other 
hand rather small. The red and blue solid lines in the figure are theory curves calculated with 
the above parameters and show good agreement with the measurement data. The extrapolated 




Figure 6. Experimental results showing the secret key rate calculated from the measured 
data for an error reconciliation efficiency of /3 = 95 % and 97 %, respectively, with hetero¬ 
dyne detection and reverse reconciliation. The red and the blue solid lines denote theory 
curves calculated from the channel parameters. Error bars are smaller than the point size. 
The theoretical model includes excess noise, which on average is Wq = 1.004 SNU and 
Wp = 1.005 SNU, respectively, and preparation noise, which is transmission dependent 
trusted noise, an artifact of the imperfect modulation. It is Kq = 0.07 SNU and Kp = 0.025 
SNU, and /i = 31.2 SNU. Eor comparison we show the secret key rates that could be ob¬ 
tained using dual-quadrature modulation with heterodyne detection, but otherwise the same 
channel. 


maximum transmission line for the single-quadrature modulation with heterodyne detection is 
slightly above 20 km for an error reconciliation efficiency of j3 = 95 % if an optical fiber with 
0.2 dB/km attenuation is employed. For an error reconciliation efficiency of j3 —91% about 
30 km is achievable. Note that the modulation variance in our experiment was fixed and not 
optimized as in the theory plots in Fig.|^since we wanted to show the agreement of measure¬ 
ment and theory with a simple dependence on the channel loss. For comparison we added 
theory curves for a dual-quadrature modulation scheme (green and black solid lines) with the 
same channel parameters, but twice the alphabet size (fl — l signal in both quadratures). In the 
intermediate region of 25 km or equivalently 5 dB channel loss, the secret key rate of our single¬ 
quadrature modulation scheme is merely a factor of about 10 lower than with two modulations 
in this particular parameter space (j3 =91%). 

3.2. Homodyne results 

The results for homodyne detection are shown in Fig. |7] For homodyne detection the prepa¬ 
ration noise was determined to Kq = 0.03 SNU. The asymmetric excess noise was Wq = 1.01 
SNU. Due to experimental imperfections in the modulators Wp scaled with the preparation 
noise to a maximum value of Wp = 1.88 SNU at Kp = 30 SNU. The high modulation variance 
of the preparation noise in the signal quadrature is responsible for the increase in P quadrature 
excess noise, since the modulators are fed with larger signals. The coloured solid lines repre¬ 
sent theoretical rates calculated from the channel parameters, and show good agreement with 
the measurement data, though it is not surprising to see dramatic reductions in distance consid¬ 
ering the high excess noise. An extrapolation similar to the one performed for the heterodyne 
data gives a maximal distance of about 20 km for an error reconciliation efficiency of j3 =91%. 
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Figure 7. Experimental results showing the secret key rate calculated from the measured 
data for an error reconciliation efficiency of 97 %, with homodyne detection and (a) direct 
reconciliation or (h) reverse reconciliation. The multiple coloured solid lines denote the¬ 
ory curves calculated from the channel parameters, with varying degrees of P-quadrature 
preparation noise. Error bars are smaller than the point size. The theoretical model includes 
excess noise, which on average was Wq = 1.01 SNU. Due to imperfections Wp scaled with 
the preparation noise to a maximum value of Wp = 1.88 SNU at Kp = 30 SNU. = 31 
SNU, and in the unencoded quadrature Kq = 0.03 SNU. Direct reconciliation shows ro¬ 
bustness against the preparation noise as expected, though the detrimental scaling of the 
excess noise diminishes the positive effect. 

4. Conclusion 

In conclusion, we have investigated a new, simplified CVQKD scheme based on single¬ 
quadrature modulation as opposed to the traditional dual-quadrature modulation scheme. In 
contrast to DVQKD, modulation in conjugate bases is not a requirement for secret key gen¬ 
eration in CVQKD. The secrecy stems from the non-orthogonality of different coherent states 
which is obtainable in a single quadrature basis. In this paper we have proven the security for 
such a scheme against collective attacks in the asymptotic limit, and we have demonstrated the 
protocol experimentally for both heterodyne and homodyne detection, and included prepara¬ 
tion noise in the theoretical description. Due to the extraordinary simplicity of the scheme, we 
expect that it will gain commercial interest. 
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